from __future__ import annotations

import pytest

from src.services.agent_openai_coordinator_adapter import (
    OPENAI_COORDINATOR_CANDIDATE_ID,
    build_openai_coordinator_candidate_result,
)


def test_openai_coordinator_adapter_emits_candidate_result_contract():
    result = build_openai_coordinator_candidate_result({
        "schema_version": "agent_replay_candidate_input_v1",
        "run_id": "run",
        "incident_id": "INC-1",
        "incident_context": {
            "severity": "P2",
            "alert_category": "kubernetes",
            "alertname": "KubeDeploymentReplicasMismatch",
            "affected_services": ["awoooi-api"],
            "namespace": "awoooi-prod",
            "signals": [
                {
                    "labels": {"deployment": "awoooi-api"},
                    "annotations": {"summary": "deployment unavailable"},
                }
            ],
        },
        "source_metadata": {},
    }).to_dict()

    assert result["schema_version"] == "agent_candidate_replay_result_v1"
    assert result["candidate_id"] == OPENAI_COORDINATOR_CANDIDATE_ID
    assert result["candidate_role"] == "coordinator_orchestrator"
    assert result["incident_id"] == "INC-1"
    assert "COORDINATE_KUBERNETES_SRE" in result["proposed_action"]
    assert result["risk_level"] == "medium"
    assert result["requires_human_approval"] is True
    assert result["fallback_used"] is False
    assert result["trace_complete"] is True
    assert result["metadata"]["adapter_mode"] == "deterministic_offline_coordinator_boundary"
    assert result["metadata"]["sdk_dependency"] == "openai_agents_sdk_package_not_installed"
    assert result["metadata"]["openai_api_calls"] is False
    assert "kubernetes_sre" in result["metadata"]["handoff_targets"]


def test_openai_coordinator_adapter_rejects_label_leak_before_execution():
    with pytest.raises(ValueError, match="evaluation label"):
        build_openai_coordinator_candidate_result({
            "run_id": "run",
            "incident_id": "INC-1",
            "incident_context": {
                "execution_success": True,
            },
            "source_metadata": {},
        })


def test_openai_coordinator_adapter_routes_security_to_human_review():
    result = build_openai_coordinator_candidate_result({
        "schema_version": "agent_replay_candidate_input_v1",
        "run_id": "run",
        "incident_id": "INC-2",
        "incident_context": {
            "severity": "P3",
            "alert_category": "secops",
            "alertname": "TlsCertificateExpiring",
            "affected_services": ["awoooi-web"],
            "signals": [{"annotations": {"summary": "certificate token auth issue"}}],
        },
        "source_metadata": {},
    }).to_dict()

    assert "COORDINATE_SECURITY_REVIEW" in result["proposed_action"]
    assert result["risk_level"] == "high"
    assert result["requires_human_approval"] is True
    assert "security_reviewer" in result["metadata"]["handoff_targets"]
    assert "independent_reviewer" in result["metadata"]["handoff_targets"]
    assert result["cost_usd"] == 0
